It would seem to make sense for a persistant attacker to collect well-publicized usernames when the original owner changes them. Imagine a journalist who publi

It would seem to make sense for a persistant attacker to collect well-publicized usernames when the original owner changes them. Imagine a journalist who publicizes a username, then changes it. The original username would linger on the Internet, in people's address books, etc. A persistant attacker might acquire it, and snap up contacts as they come in. Maybe Signal should have made usernames non-reusable, at least as an option. They still could dissociate the username from the phone number when the user 'deletest' it. The deleted username would just be shifted to the null user.